High
SageMaker
Regional
SageMaker model explainability job definitions should have network isolation enabled
Description
Flags Amazon SageMaker model explainability monitoring job definitions whose NetworkConfig.EnableNetworkIsolation is disabled. Without isolation the containers can reach external networks.
Remediation
Recreate the model-explainability job definition with NetworkConfig.EnableNetworkIsolation=true.
Steps
- Identify the affected resource via the SageMaker console or the CLI.
- Recreate it with the relevant NetworkConfig field set to true.
- Update any monitoring schedules or pipelines that reference the old definition.